# Configure a Binary Authorization policy with Cloud Run

This quickstart shows how to configure and test a basic
[rule](https://docs.cloud.google.com/binary-authorization/docs/key-concepts.md.txt#rules) in a Binary Authorization [policy](https://docs.cloud.google.com/binary-authorization/docs/key-concepts.md.txt#policies)
with Cloud Run.

In this quickstart, you use Binary Authorization to control deployment of a
Cloud Run service.

## Before you begin

## Create a service with Binary Authorization enabled

To create a Cloud Run service with Binary Authorization
enabled, do the following:

1. [Go to Cloud Run](https://console.cloud.google.com/run?enableapi=true)

2. Click **Create service** to display the *Create service* form:

   ![image](https://docs.cloud.google.com/static/run/docs/images/create-service-form.png)

   In the form that displays, do the following:
   1. Select Cloud Run as your development platform.
   2. Select the [region](https://cloud.google.com/about/locations) where you want your service located.
   3. Specify the name you want to give to your service---for example, `test-service`.
   4. Click **Next** to continue to the *Configure the service's first
      revision* page.

      In the form, do the following:
      1. Select **Deploy one revision from an existing container image**.
      2. Use `us-docker.pkg.dev/cloudrun/container/hello` as the container image.

         > [!NOTE]
         > **Note:** The example image name is for demonstration purposes. We recommend that you use Binary Authorization to deploy only images that you maintain.

      3. Expand the **Advanced settings** section.

      4. Click the **Security** tab.

      5. Select the **Verify
         container deployment with Binary Authorization** checkbox:

         ![image](https://docs.cloud.google.com/static/binary-authorization/docs/images/cloud-run-advanced-settings-rectangle.png)

         > [!NOTE]
         > **Note:** If your [organization policy requires Binary Authorization for Cloud Run](https://docs.cloud.google.com/binary-authorization/docs/run/requiring-binauthz-cloud-run.md.txt), the checkbox is disabled.

         By default, the Binary Authorization policy allows all images to
         be deployed.
      6. Click **Next** to continue to the *Configure how this service is
         triggered* page:

         ![image](https://docs.cloud.google.com/static/run/docs/images/create-service-form3.png)
      7. Select **Allow public access** to be able to open the
         result in your web browser

      8. Click **Create** to deploy the image to Cloud Run and wait
         for the deployment to finish.

      Your service is deployed. Revisions are subject to
      Binary Authorization policy enforcement.

## Update the Binary Authorization policy to disallow all images

The Binary Authorization policy contains a default rule. This rule governs the
deployment of the Cloud Run service you just created.

By default, the rule allows all container images to be deployed.

To view the default policy, do the following:

1. [Go to Binary Authorization](https://console.cloud.google.com/security/binary-authorization/)

   ![Screenshot of policy tab showing default rule](https://docs.cloud.google.com/static/binary-authorization/docs/images/default-rule-policy-tab.png)
2. Click **Edit Policy**.

3. In **Project Default Rule** , note that the option **Allow All Images** is
   selected.

   ![Screenshot of the option to choose a default rule type](https://docs.cloud.google.com/static/binary-authorization/docs/images/default-rule-select-evaluation-mode-allow.png)

Now, modify the policy to *block all images from being deployed*, by doing the
following:

1. Go to the **Binary Authorization** page in the Google Cloud console.

   [Go to Binary Authorization](https://console.cloud.google.com/security/binary-authorization/policy)
2. Click **Edit Policy**.

3. In **Default rule** , select **Disallow All Images**.

   ![Screenshot of the option to choose a default rule type](https://docs.cloud.google.com/static/binary-authorization/docs/images/default-rule-select-evaluation-mode-disallow.png)
4. Click **Save Policy**.

> [!NOTE]
> **Note:** It can take a few minutes for the policy to take effect.

## Redeploy the service

Test the updated policy by deploying a new revision.

To deploy the image, do the following:

1. [Go to Cloud Run](https://console.cloud.google.com/run?enableapi=true)

2. Click the name of the service you deployed earlier in this guide.

3. Click Edit and deploy new revision.

4. Click **Deploy**.

You see an error message similar to the following:

    Service update rejected by Binary Authorization policy: Revision
    REVISION uses unauthorized container image. Container image 'us-docker.pkg.dev/cloudrun/container/hello@SHA' is not authorized by policy. Denied by an ALWAYS_DENY admission rule

## Reset the policy to allow all images

To reset the policy to allow all images, do the following:

1. Go to the **Binary Authorization** page in the Google Cloud console.

   [Go to Binary Authorization](https://console.cloud.google.com/security/binary-authorization/policy)
2. Click **Edit Policy**.

3. Select **Allow All Images**.

4. To save the policy, click **Save Policy**.

You can now deploy images.

## Clean up


To avoid incurring charges to your Google Cloud account for
the resources used on this page, follow these steps.

To delete the service you created in Cloud Run, do the
following:

1. [Go to Cloud Run](https://console.cloud.google.com/run)

2. Locate the service you want to delete in the services list, and click
   its checkbox to select it.

3. Click **Delete**. This deletes all revisions of the service.

To disable Binary Authorization, see [Disabling Binary Authorization](https://docs.cloud.google.com/binary-authorization/docs/run/disabling-binauthz-cloud-run.md.txt).

## What's next

- Use [breakglass](https://docs.cloud.google.com/binary-authorization/docs/run/using-breakglass-cloud-run.md.txt) to
  bypass Binary Authorization enforcement.

- Use the `built-by-cloud-build` attestor to [deploy only images built by Cloud Build](https://docs.cloud.google.com/binary-authorization/docs/deploy-cloud-build.md.txt).

- [Use attestations](https://docs.cloud.google.com/binary-authorization/docs/attestations.md.txt).

- Configure the Binary Authorization policy by using the [Google Cloud console](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-console.md.txt) or the [command-line tool](https://docs.cloud.google.com/binary-authorization/docs/configuring-policy-cli.md.txt).

- [View Binary Authorization for Cloud Run events in Cloud Audit Logs](https://docs.cloud.google.com/binary-authorization/docs/run/viewing-audit-logs-cloud-run.md.txt).